Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

I think its infected........(or possessed)

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: I think its infected........(or possessed)

Unread postby Deogee » November 2nd, 2010, 12:00 pm

ComboFix Log:
ComboFix 10-11-01.05 - Mark 11/02/2010 11:38:46.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.261 [GMT -4:00]
Running from: c:\documents and settings\Mark\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
\\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
.
\\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((((( Files Created from 2010-10-02 to 2010-11-02 )))))))))))))))))))))))))))))))
.

2010-11-02 12:56 . 2010-11-02 12:56 -------- d-----w- c:\documents and settings\Mark\Application Data\Malwarebytes
2010-11-02 12:56 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-02 12:55 . 2010-11-02 12:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-02 12:55 . 2010-11-02 12:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-02 12:55 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-02 12:34 . 2010-11-02 12:34 -------- d-----w- C:\_OTL
2010-10-31 02:48 . 2010-10-31 02:48 -------- d-----w- c:\program files\Crawler
2010-10-31 02:47 . 2010-10-31 02:47 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-10-31 02:47 . 2010-11-02 10:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2010-10-31 02:47 . 2010-11-02 04:01 -------- d-----w- c:\documents and settings\Mark\Application Data\Spyware Terminator
2010-10-31 02:47 . 2010-11-02 04:00 -------- d-----w- c:\program files\Spyware Terminator
2010-10-29 11:12 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-29 11:12 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-10-29 11:10 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-28 21:17 . 2010-05-08 19:52 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-09-18 16:23 . 2004-08-04 10:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-04 10:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-04 10:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-04 10:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-09 14:16 . 2006-03-04 03:33 667136 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 14:16 . 2004-08-04 10:00 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-09-09 14:16 . 2004-08-04 10:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-09-08 16:49 . 2004-08-04 10:00 369664 ----a-w- c:\windows\system32\html.iec
2010-09-01 11:51 . 2004-08-04 10:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-04 10:00 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-04 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-04 10:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-04 10:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-06-21 11:31 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-04 10:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-04 10:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-06-28 20:59 153184 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-27 135664]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-10-31 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-13 135168]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-21 198160]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840]
"dleamon.exe"="c:\program files\Dell V310-V510 Series\dleamon.exe" [2010-01-18 770728]
"EzPrint"="c:\program files\Dell V310-V510 Series\ezprint.exe" [2010-01-18 139944]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-10-31 2174464]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe" [2010-07-25 231888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-01-29 21:17 64592 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\dleacoms.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/28/2010 5:08 PM 312912]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/1/2009 9:31 PM 165456]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [10/30/2010 10:47 PM 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/1/2009 9:31 PM 17744]
R2 dlea_device;dlea_device;c:\windows\system32\dleacoms.exe -service --> c:\windows\system32\dleacoms.exe -service [?]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [6/21/2009 8:43 PM 10384]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [6/3/2009 10:24 PM 88192]
S2 dleaCATSCustConnectService;dleaCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dleaserv.exe [3/7/2010 11:41 AM 98984]
S3 Ptserli;PCTEL Serial Device Driver for INTEL;c:\windows\system32\drivers\ptserli.sys [6/3/2009 10:30 PM 128286]
.
Contents of the 'Scheduled Tasks' folder

2010-10-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-10-31 c:\windows\Tasks\File Helper.job
- c:\program files\File Helper\1.1.0.4\FileHelper.exe [2009-11-20 18:49]

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-688789844-839522115-1003Core.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-27 13:29]

2010-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-688789844-839522115-1003UA.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-27 13:29]

2010-11-02 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\lshiwz9l.default\
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-02 11:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(880)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(2036)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Apoint\HidFind.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\windows\system32\basfipm.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\dleacoms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\pctspk.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-11-02 11:58:34 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-02 15:58

Pre-Run: 43,232,358,400 bytes free
Post-Run: 43,154,591,744 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 99B2D2A033885F263F0F578494F2A741
Deogee
Active Member
 
Posts: 13
Joined: October 31st, 2010, 11:29 pm
Advertisement
Register to Remove

Re: I think its infected........(or possessed)

Unread postby deltalima » November 2nd, 2010, 2:56 pm

Hi Deogee,

Please reboot the computer and then run another quick scan with Malwarebytes and post the log in your next reply.

Please also let me know how the computer is running now.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: I think its infected........(or possessed)

Unread postby Deogee » November 2nd, 2010, 5:53 pm

deltalima,

My PC seems to be cured!! Things are running much faster & much more reliably! Many, MANY thanks!!

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5021

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11/2/2010 4:25:56 PM
mbam-log-2010-11-02 (16-25-56).txt

Scan type: Quick scan
Objects scanned: 133818
Time elapsed: 11 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Deogee
Active Member
 
Posts: 13
Joined: October 31st, 2010, 11:29 pm

Re: I think its infected........(or possessed)

Unread postby deltalima » November 2nd, 2010, 6:00 pm

Hi Deogee,

My PC seems to be cured!! Things are running much faster & much more reliably!


It's looking good, let's do some final checks to make sure.

You should Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 9.4 are vulnerable.
  • Go HERE, UNCHECK any Free Add-Ons, and click Download to install the latest version of Adobe Acrobat Reader.
  • After it completes the Installation, close the Download Manager.

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 22.
  • Download the latest version of Java Runtime Environment (JRE) 6 Here
  • Scroll down to where it says "JDK 6 Update 22 (JDK or JRE)"
  • Click the orange Download JRE button to the right
  • Select the Windows platform from the dropdown menu
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
  • Click on the link to download Windows Offline Installation & save the file to your desktop
  • Close any programs you may have running - especially your web browser
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions
  • Reboot your computer once all Java components are removed
  • Then from your desktop double-click on jre-6u22-windows-i586-p.exe to install the newest version

Please go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: I think its infected........(or possessed)

Unread postby Deogee » November 3rd, 2010, 6:51 am

deltalima,

Kaspersky has my browser listed as a Safari , when I'm using Chrome. Is it alright to run this scan using either Firefox, or IE as the browser? I didn't see Chrome listed as an approved type of browser.
Deogee
Active Member
 
Posts: 13
Joined: October 31st, 2010, 11:29 pm

Re: I think its infected........(or possessed)

Unread postby deltalima » November 3rd, 2010, 6:55 am

Internet Explorer should be fine.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: I think its infected........(or possessed)

Unread postby Deogee » November 3rd, 2010, 10:25 am

Well, Kaspersky doesn't seem to like running on either Firefox or IE. I get to the scanning part & the scan starts, but seems to not move beyond 2% after an hour (or better) of scan time.
I have the anti-virus programs (Avast & Spyware Terminator) shut down (which makes me feel pretty vulnerable).
Anything else I can/should do?
Thanks.
Deogee
Active Member
 
Posts: 13
Joined: October 31st, 2010, 11:29 pm

Re: I think its infected........(or possessed)

Unread postby deltalima » November 3rd, 2010, 10:29 am

Hi Deogee,

Kaspersky doesn't seem to like running


It can take a long time as it is very thorough.

If it refuses to progress any further then please run this alternative scan

ESET online scannner

  • Please go Here then click on: Image
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on: Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: I think its infected........(or possessed)

Unread postby Deogee » November 3rd, 2010, 2:58 pm

deltalima,
I managed to get Kaspersky to run & apparently, I still have a bug:


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, November 3, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, November 03, 2010 10:45:51
Records in database: 4205373
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 53251
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 03:04:46


File name / Threat / Threats count
C:\Qoobox\Quarantine\MBR_HardDisk0.mbr Infected: Trojan-Clicker.Win32.Wistler.a 1

Selected area has been scanned.
Deogee
Active Member
 
Posts: 13
Joined: October 31st, 2010, 11:29 pm

Re: I think its infected........(or possessed)

Unread postby deltalima » November 3rd, 2010, 3:26 pm

Hi Deogee,

apparently, I still have a bug:


C:\Qoobox\Quarantine\MBR_HardDisk0.mbr Infected


That is OK!, it is the folder that Combofix makes a backup of items that it removes, we will remove that folder in the steps below, if you wish run another Kaspersky scan later to confirm.

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

Remove GMER

Delete the GMER icon from your desktop.

Uninstall ComboFix

  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK

Clean up with OTL

  • Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CleanUp! button
  • Say Yes to the prompt and then allow the program to reboot your computer.


Create a new, clean System Restore point which you can use in case of future system problems:
  • Press Start >> All Programs >> Accessories >>System Tools >> System Restore
  • Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
  • Now remove old, infected System Restore points:
  • Next click Start >> Run and type cleanmgr in the box and press OK
  • Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
  • Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
  • Press OK and Yes to confirm

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check


You MUST upgrade Internet Explorer from version 6 to version 8!!!!
Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety


Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: I think its infected........(or possessed)

Unread postby Deogee » November 3rd, 2010, 4:11 pm

Who-HOO!! <insert dance of joy here> :bounce: That's good news Deltalima!!
I'll follow the above recommendations, but I want to thank you--no way I could've done this without your EXCELLENT help!!
You guys/gals are the BEST!! :king:
Deogee
Active Member
 
Posts: 13
Joined: October 31st, 2010, 11:29 pm

Re: I think its infected........(or possessed)

Unread postby deltalima » November 3rd, 2010, 4:13 pm

You're welcome!

Glad we could help.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: I think its infected........(or possessed)

Unread postby Gary R » November 4th, 2010, 9:54 am

As your problems appear to have been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 486 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware